Description

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T21:17:37.440Z",
  "pubdate": "2026-08-12T21:17:37.440Z",
  "executiveSummary": "A memory corruption vulnerability exists in the MongoDB BI Connector ODBC Driver due to a missing bounds check when parsing stored procedure parameter metadata.\nThe vulnerability allows an attacker who controls the connected server, or possesses the capability to respond in its place, to supply malformed metadata.\nSuccessful exploitation results in an out-of-bounds write within the memory space of the client application process.\nThe primary impacts include abnormal termination of the client application leading to a denial of service, or potentially the execution of unintended code under certain operating conditions.\nThe risk implication is severe for environments where client applications connect to untrusted or compromised database servers.\nExploitation strictly requires the attacker to exert control over the server or manipulate network traffic to inject malicious parameter metadata responses during the parsing phase.",
  "technicalDetails": "The root cause of the vulnerability is an inadequate bounds validation check during the parsing of stored procedure parameter metadata within the MongoDB BI Connector ODBC Driver.\nWhen a client application queries stored procedure metadata from the database server, the driver processes the incoming data stream containing parameter definitions.\nDue to the missing boundary verification, specially crafted or maliciously altered metadata responses containing excessive length or offset values can cause the driver to write data outside the allocated boundaries of internal heap or stack buffers.\nThe vulnerable component is the metadata parsing module of the MongoDB BI Connector ODBC Driver.\nThe attack flow proceeds as follows: First, the client application initiates a connection and requests stored procedure parameter information from the database server. Second, an adversarial server or an adversary positioned to perform a machine-in-the-middle or spoofing attack intercepts or responds to the metadata request. Third, the attacker returns a specially formatted response with manipulated parameter metadata. Fourth, upon receiving the response, the driver attempts to parse the metadata without validating the input lengths against buffer allocations. Fifth, the lack of bounds checking results in an out-of-bounds write, corrupting adjacent memory structures in the client process space.\nDepending on the corrupted memory layout and heap architecture, this memory corruption can lead to immediate application crashes causing denial of service, or potential control flow hijacking and arbitrary code execution.\nThe exploitation vector relies on network interaction between the client driver and the database server, necessitating server compromise or network spoofing capabilities."
}